Need confirmation of Win95 password encryption back door

[Brian Gorka]

A friend and I were working on an exploit of this.  It is true.  We were 
not working on a grepper, but we found the offset where the passwords 
reside and were going  to dump them into a dialog box.  If you are planning 
to exploit this, we will stop our previous efforts.
----------
From: 	Rich Graves[SMTP:llurch at networking.stanford.edu]
Sent: 	Monday, January 15, 1996 5:20 PM
To: 	cypherpunks at toad.com
Cc: 	frank at funcom.no; pgut01 at cs.auckland.ac.nz
Subject: 	Need confirmation of Win95 password encryption back door

-----BEGIN PGP SIGNED MESSAGE-----

A Major Media Outlet requires confirmation that Windows 95, to facilitate
its automatic reconnect feature for sleeping laptops and temporary network
outages, caches all network passwords (NetWare, NT, UNIX running Samba,
SLIP/PPP dialup) in unprotected memory in clear text, whether you've
disabled persistent "password caching" to disk and applied the December
14th 128-bit RC4 .PWL patch, or not. There seems to be no way to turn
this off.

The idea, of course, is that a simple trojan horse could do whatever it
wanted with this information.

We know that this vulnerability exists in Windows for Workgroups, and
Peter wrote a little demo (on hackmsoft page below, without source), but
the APIs appear to have changed in Win95.

So, anyone have Win95 and some time to kill, or can anyone recommend a
good DOS/Windows RAM grepper?

- -rich at c2.org
 http://www.c2.org/hacknmsoft/

 $ Mon Jan 15 22:17:10 PST 1996 $
 $ From llurch at networking.stanford.edu to cypherpunks at toad.com $

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMPtDLo3DXUbM57SdAQEN7QP+J6Gmk6m8dv3X96SKZciI/L7DM04bDSoi
HZa+dIoajAiRrfG9oSNcIYbVDDs67qwCSKGFg9hc5K3x99nhbq3Aw2mio62YQj+2
K62pBT9hQLe4dv8AMhLtIqyG4ZztYy+dDjGzsaUIkBUZKo5//Eh8c81xXLQrqXtk
RFV+xkXBgww=
=12rk
-----END PGP SIGNATURE-----






----------
Brian Gorka
Key fingerprint =  ED 7D 78 7E 95 E8 05 01  27 01 A1 74 FA 4B 86 53